NoFrak

NoFrak NoFrak is a Proof of Concept implementation for Android designed to prevent fracking attacks described in "Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks", by Martin Georgiev, Suman Jana, and Vitaly Shmatikov. NDSS 2014. Cordova Android Cordova...

EUVD-2017-12292

Malware in sbrugna...

CVE-2020-11990

We have resolved a security issue in the camera plugin that could have affected certain Cordova Android applications. An attacker who could install or lead the victim to install a specially crafted or malicious Android application would be able to access pictures taken with the app externally...

PT-2020-12969

Name of the Vulnerable Software and Affected Versions Cordova Android affected versions not specified Description A security issue in the camera plugin could have allowed an attacker to access pictures taken with the app externally if they could install a specially crafted Android application. Th...

Information Exposure in cordova-android

Versions of cordova-android prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maxim...

GHSA-GWPF-62XP-VRG6 Information Exposure in cordova-android

Versions of cordova-android prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maxim...

GHSA-C6PW-Q7F2-97HV Privilege Escalation in cordova-plugin-inappbrowser

Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android...

Information Exposure

Overview Versions of cordova-android prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default...

Man-in-the-Middle (MitM)

cordova-android is vulnerable to man-in-the-middle MitM attacks. These attacks are possible because the Gradle distribution is downloaded using http, not https. This download happens when the project is build using scripts, the first build or the first time Android is added to cordova...

CVE-2017-3160

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity...

Denial of service

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity...

CVE-2017-3160

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity...

PT-2018-7228

Name of the Vulnerable Software and Affected Versions: Cordova-Android versions prior to 6.1.2 Description: The issue arises when the Android platform is added to Cordova for the first time or after a project is created using the build scripts. The scripts fetch Gradle on the first build, but sin...

CVE-2017-3160: Undefined Security Weakness

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity...

CVE-2015-1835

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...

CVE-2015-1835: Improper Input Validation

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...

PT-2017-6525

Name of the Vulnerable Software and Affected Versions Apache Cordova Android versions prior to 3.7.2 Apache Cordova Android 4.x versions prior to 4.0.2 Description The issue allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL, when a...

Apache Cordova Android Information Disclosure Vulnerability

Adobe PhoneGap is the United States of America Odobe Adobe company's set of open source development frameworks. Apache Cordova Android is the United States of America Apache Apache Software Foundation Apache a set of platforms that can be used in the development of Android-based mobile applicatio...

CVE-2016-6799

Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods Log.v, Log.d, Log.i, Log.w, and Log.e are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition...

@owstack/ows-wallet (>=0.0.1, <=0.0.3), copay-dash (2.4.0) +4 more potentially affected by CVE-2016-6799 via cordova-android (>=3.7.2, <=5.2.2)

cordova-android NPM version =3.7.2, =0.0.1, =0.0.6, =2.0.1, =0.0.1, =0.0.1-dev, =0.1.0 Source cves: CVE-2016-6799 Source advisory: MEND:CVE-2016-6799...